►
From YouTube: The DEF Con Code of Conduct Lawsuit - Lessons learned and Tips for Managing Legal - Joanna Lee
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
The DEF Con Code of Conduct Lawsuit - Lessons learned and Tips for Managing Legal Risk when Enforcing Codes of Conduct" - Joanna Lee, Partner, GesmerUpdegrove LLP
Speakers: Joanna Lee
Are Codes of Conduct risky business? The pending lawsuit against the organizers of DEF CON hacker conference arising from Code of Conduct enforcement decision suggests so. In this session, we'll discuss:
The factual background, legal claims, and status of the DEF CON lawsuit (to the extent publicly known),
What Code of Conduct responders can learn from the lawsuit,
Legal risks associated with Code of Conduct enforcement, and
Tips and best practices for managing legal risk and minimizing the threat of litigation.
A
Fantastic?
Well,
thank
you
all
for
the
work
you
do
in
the
space.
It's
so
so
valuable
and
important.
The
work
of
keeping
our
communities
healthy,
thriving
and
safe.
So
the
vast
majority
of
a
code
of
conduct
incidents
where
the
the
severity
of
the
behavior
is
low.
You
know,
for
example,
if
it's
just
you
know,
rudeness
or
you
know,
arguments
about
why
a
pull
request
wasn't
merged.
A
The
legal
risks
are
very,
very
low
when
the
legal
risk
increases
is
going
to
depend
on
the
type
of
violation
and
its
severity,
as
well
as
what
remedy
you're,
considering
so
in
the
event
that
somebody
was
physically
assaulted
or
there's
a
sexual
harassment
or
if
you're,
considering
permanently
Banning.
Somebody
from
a
community
or
issuing
some
of
a
public
or
semi-public
statement
that
could
have
an
impact
on
their
either
their
personal
reputation
or
their
their
professional
life
or
their
business.
That's
when
the
legal
risk
is
much
greater.
A
This
is
a
very
U.S
Centric
presentation,
based
primarily
in
the
U.S
legal
system.
I
am
a
U.S
licensed
lawyer,
I'm
not
licensed
to
practice.
Another
jurisdictions,
I
do
have
some
experience
with
international
law,
but
but
this
is
going
to
be
based
primarily
on
use
law,
also
I'm
going
to
try
as
hard
as
I
can
to
make
this
understandable
to
non-lawyers.
But,
just
like
you
know,
Engineers,
when
you're
speaking
with
business,
folks,
even
the
same
company,
sometimes
times
you
have
to
do
a
little
translation
and
there's
an
acronym,
they
don't
get.
A
So
we
have
a
case
study
and
process
in
progress,
so
the
organizers
of
Defcon,
which
is
a
security
hacker
conference
annual
hacker
conference,
have
been
sued
by
an
accused
person,
so
just
a
little
bit
of
background
about
it.
So
this
is
an
annual
conference
and
late
last
year,
an
ex-employee
of
a
company
called
social
engineer
LLC
that
Chris
hadnegie
is
a
plaintiff.
In
this
case
he
is
the
owner
and
president
of
social
engineer
LLC.
A
So
one
of
his
ex-employees
didn't
directly
go
to
the
Defcon
organizers,
but
went
indirectly
through
third
party,
and
essentially
we
don't
know,
there's
and
we
don't
know
whether
it
was
part
of
an
official
Complaint
or
an
unofficial
complaint.
There's
actually
a
lot.
We
don't
yet
know
about
this
lawsuit
and
later
on,
I'll
explain
a
little
bit
why
that
is,
but
the
the
event
organizers
found
out
through
third
party,
that
there
were
allegations
of
abuse,
harassing
and
controlling
behavior.
A
My
this
ex-employee
and
then
the
conference
organizers
claim
that
they
connected
with
at
least
half
a
dozen
other
community
members
who
had
similar
complaints
about
this
individual
and
for
that
reason
they
decided
to
ban
him
from
the
event.
We
still
don't
actually
know
what
the
type
of
misconduct
is
beyond
the
that
vague
statement
about
harassment
and
controlling
Behavior.
A
So,
additionally,
so
so
Defcon
conducted
its
investigation
and
then
notified
Chris
hadnegie
that
he
was
going
to
be
banned
from
all
future
Defcon
events
so
permanently
banned
from
this
community
and
they
also
as
many
communities
do.
They
publish
a
transparency
report
on
their
website
that
summarizes
at
a
high
level
What
what
code
of
conduct
incidents
have
been
reported
and
how
they're
resolved
and
so
there's
a
public
statement
on
their
website
in
the
form
of
a
transparency
report,
and
this
is
a
screenshot
of
it.
A
A
A
A
So
the
the
essential
facts
that
the
complaint
alleges
is
that
the
code
of
conduct
itself
for
Defcon
is
vague
and
ambiguous,
so
the
accused
wasn't
really
given
notice
of
what
type
of
behavior
it
did
and
didn't
prohibit.
Also,
it
alleges
that
Chris
has
never
been
still
to
this
day
has
not
been
informed
about
what
Behavior
he
engaged
in
that
allegedly
violated
the
code
of
conduct.
A
Despite
the
fact
that
he's
made
multiple
requests,
he
claims
that
Defcon
Communications
has
not
provided
any
support
or
evidence
or
any
explanation
whatsoever,
justifying
the
ban
and
also
that
it
was
given
to
him
completely
without
warning.
He
didn't
know
that
there
was
an
investigation,
ongoing
Etc,
and
this
does
suggest
I
mean,
although
the
complaint
doesn't
explicitly
allege
this.
It
does
very
much
suggest
that
he
was
not
interviewed
as
a
witness
that
he
wasn't
given
an
opportunity
to
provide
his
side
of
the
story
or
present
his
own
evidence.
A
So
he
claims
that,
due
to
these
vague
and
ambiguous
statements
that
nonetheless
were
very
concerning
because
they
do
say
the
the
violations
were
so
so
egregious
that
it
warrants
a
permanent
ban,
he's
claiming
that
there
was
a
firestorm
of
social
media
commentary
on
this
and
that
the
community
has
speculated
that.
It
must
be
something
really
really
really
terrible
like
sexual
assault
or
other
abhorrent
Behavior,
especially
because
this
is
a
community
that
supports
supports,
eccentricity
and
weirdness.
A
A
So
the
he's
brought
several
claims
or
causes
of
action,
and
these
are
these
are
a
lot
of
these
are
legalese
words
that
just
start
they're
different
types
of
claims
that
a
plaintiff
can
bring
in
in
this
factual
situation.
Why
and
I'll
and
I
will
explain
what
what
each
of
these
means
in
a
bit
more
detail
in
the
future.
Slides
defamation
is
one
of
them
intentional
and
tortious.
A
Interference
with
contractual
relations
is
another
invasion
of
privacy
and
false
light
is
another,
an
intentional
infliction
of
emotional
distress
so
see
these
are
the
the
different
claims
that
are
being
brought.
So
what
what
does
defamation
mean?
So
I'm
going
to
go
through
so
eastern
district
of
Pennsylvania,
so
Pennsylvania
every
state
has
slightly
different
laws
on
what
each
of
these
types
of
claims
mean.
A
So
the
exact
wording
of
what
constitutes
defamation
in
Pennsylvania
might
be
a
little
bit
different
than
you
know
what
constitutes
defamation
in
California,
so
here
I'm
going
to
be
talking
because
I
want
to
make
this
more
universally
applicable.
If
you
actually
read
the
complaint
in
Pennsylvania
law,
it's
a
little
bit
different.
What
I'm
going
to
present
but
I'm
going
to
present
the
more
general
definition
of
defamation,
so
first
there
has
to
be
a
false
statement
that
purports
to
be
a
fact.
A
In
order
for
defamation,
for
a
claim
of
defamation
to
succeed,
there
also
has
to
be
either
a
publication
of
that
or
communication
to
a
third
person,
so
it
doesn't
necessarily
have
to
be
something.
That's
you
know
publicly
available
on
a
website.
It
could
be.
You
know,
saying
something
untrue
about
a
company
to
their
their
customer.
That
would
be
an
example
of
a
communication
that
could
qualify
for
this
element.
A
A
You
know
that
that
is
arguably
true
right
and
Chris
hadnegie
of
the
southeast,
about
Chris
hanegi
of
the
Southeast
Village,
and
after
conversations
with
the
reporting
parties
and
Chris,
we
are
confident
the
severity
of
the
transgressions
meritsubian
from
Defcon.
So
it
is
phrased
as
an
opinion
statement,
and
while
this
is,
you
know,
I'm
not
going
to
there's
still
so
much.
A
We
don't
know
about
the
case
so
I'm,
just
not
in
the
position
to
really
provide
an
assessment
of
whether
I
think
you
know
which
party
is
right
or
wrong
or
whether
who's
likely
to
succeed
in
this
case.
But
I
will
just
say
that
this
is
probably
I.
I
think
that
this
is
probably
well
worded
from
a
defamation
perspective.
A
If
you
read
these
statements
hard
to
argue
that
they're,
objectively
false
but
false
light
claim,
is
a
little
bit.
There
doesn't
have
to
be
such
overt
explicit
falsity
to
to
succeed
in
a
false
light
claim
it
could
be
just
you
know,
you're
suggesting
something
that
is
untrue.
So,
for
example,
if
there's
a
news
article,
you
know
talking
about
there's
a
news
article
talking
about
you
know
how
an
organization
has
engaged
in.
A
You
know
some
some
terrible
behavior
and
there's
a
picture
of
an
employee
of
that
organization
in
that
news
article
and
that
employee
actually
had
nothing
to
do
with
the
the
behavior
that
just
the
fact
that
that
picture
is
there
suggests
that
they
were
involved
and
so
that
person
could
probably
bring
a
false
light
claim.
Even
though
inclusion,
the
picture
itself
doesn't
isn't
actually
there's
not
conveying
in
a
false
statement,
but
there
is
a
a
presentation
of
a
and
and
suggestion
that
that
in
that
implies
involvement.
A
So
organizers
of
conference
would
need
to
have
known
about
this
contractual
relationship,
and
at
this
point
it's
not
it's
not
known
whether
or
not
they
they
knew
or
not,
and
that
the
defendant
intentionally
and
improperly
interfered
with
that
contractual
relationship
and
that
the
plaintiff
suffered
some
damage.
As
a
result,
you
know
in
this
case
the
damage
is
that
he
lost
at
least
one
one
customer
relationship.
A
And
in
Defcon
Communications
response
to
the
complaint,
their
primary
defense
was
that
they,
you
know,
maybe
some
damage
had
resulted
from
their
actions,
but
this
third
element
has
not
been
satisfied.
There
was
no
intention.
There
was
no
intention
to
harm
Chris
or
his
company
by
interfering
with
his
customer
relationships
and
there
was
nothing
improper
about
their
actions
in
publishing
a
transparency
report.
A
So
that's
that's
essentially
the
core
of
their
defense
on
this
claim,
and
the
final
claim
is
intentional
infliction
of
emotional
distress
and
in
order
to
succeed
with
this
type
of
claim,
these,
these
elements
need
to
be
satisfied.
So
there
needs
to
be
the
defendant
needs
to
have
engaged
in
conduct
that
is
Extreme
and
outrageous
and
and
again
this
is
we're
talking
about
Defcon
Communications
here,
so
the
conference
organizers
would
have
had
to
engage
in
conduct
that
is
Extreme
and
outrageous.
They
would
have
had
to
act
intentionally,
or
at
least
recklessly.
A
This
would
have
had
to
cause
emotional
distress
that
is
severe
and
then
Under
Pennsylvania
law,
also
physical
injury
or
harm
there's
some
case
law
that
says
physical
injury
or
harm
is
required.
So
defcon's
defenses
that
you
know.
First
of
all,
Chris
hadnegie
and
his
company
have
not
been
physically
harmed
in
any
way,
but,
moreover,
that
there
is
nothing
extreme
or
outrageous
in
publishing
a
transparency
report
and
the
the
bar
for
what
constitutes
extreme.
A
Even
outrageous
behavior
is,
you
know
it
is
fairly
High
I
mean
it
really
has
to
be
atrocious,
behavior
and
so
Defcon
is
arguing
well
clearly,
publishing
a
transparency
report
is
not
is
not
extremely
outrageous
and,
furthermore,
that
they
were
trying
to
protect
the
community's
safety
and
the
community
interests
that
there
was.
There
was
a
community.
There
was
a
larger
good
public
public
interest
and
good
that
that
justified
this
Behavior
also
undermining
the
the
claim
that
it
could
have
been
extreme
and
outrageous.
A
So
the
case
is
in
progress.
Defcon
Communications
has
filed
a
motion
to
dismiss,
and
what
that
means
is
that,
essentially,
what
that
means
is.
They
are
they're
they're
trying
to
persuade
the
judge
that
this
claim
is
completely
meritless.
Just
by
reading
the
complaint
it's
Merit
list,
we
don't
even
have
to
go
to
trial.
We
don't
even
have
to
go
to
Discovery,
so
they're
seeking
dismissal
before
we
proceed
to
the
further
stages
of
the
investigation.
A
So
if
the
motion
is
not
denied
though-
and
it
will,
it
will
add
me
on
so
it's
possible
that
some
of
these
claims
will
be
dismissed.
But
if
there's
at
least
one
claim
that
the
judge
thinks
there
should
at
least
be
discovery
of
factual
evidence
on
the
case
will
proceed
and
then
we'll
proceed
to
a
phase
of
litigation
called
Discovery.
This
is
where
each
party
and
their
attorney
gets
to
issue
subpoenas,
depose,
Witnesses
and
ask
for
documentary
evidence
and
I
I
want
to.
A
This
is
really
really
important
and
I
think
one
of
the
the
perhaps
the
most
compelling
reason
why
we
should
do
our
best
to
avoid
litigation
with
regard
to
code
of
conduct
enforcement
in
Discovery,
highly
personal
and
sensitive
information
of
reporters
and
victims
and
Witnesses
who
participate
in
the
investigation,
could
come
to
light
and
become
publicly
available
and
in
order
to
make
help
keep
communities
safe.
We
need
to
create
safe
spaces
for
reporting
and
litigation
is
unfortunately,
only
under
unusual
circumstances
can
very
unusual
circumstances.
A
Also
Witnesses
reporters
victims,
they
could
all
be
compelled
to
testify
and
that
you
know
for
somebody
who
has
who
has
suffered
harm
or
at
least
feels
that
they
have
suffered
harm
you're
asking
me
to
testify
in
an
illegal
setting,
and
you
know
confront
the
person
that
you
know
they
see
as
an
abuser
can
also
be.
It
can
be
traumatizing
and
very,
very
emotionally
upsetting.
A
If
the
the
case
continues
to
proceed,
and
that
includes
information
and
documentation
pertaining
to
the
code
of
conduct,
violation,
identities
of
any
fact
Witnesses,
they
would
depose
all
of
the
witnesses,
which
basically
means
you
know
not
not
in
a
court,
but
in
a
in
a
in
a
private
setting.
Well,
not
not
exactly
a
private
setting,
but
as
part
of
a
an
official
proceeding
with
attorneys
present,
they
would
be
interviewing
the
witnesses
on
record
to
find
out
more
information.
A
A
So
issues
that
are
likely
to
be
scrutinized
include
whether
the
and
debated
are
whether
the
investigation
is
fair
at
their
own
partial,
The,
credibility
and
possible
motivations
of
witnesses
and
reporters
and
whether
all
available
evidence
have
been
considered.
The
fact
that
I
mean,
if
it's
true
what's
said
in
the
complaint
that
Chris
was
never
did
not
have
any
notice
that
there
was
an
investigation
pending
and
still
doesn't
know
what
the
alleged
misconduct
is.
A
You
know
that
that
does
highly
suggest
that
not
all
information
had
been
considered
because
they
never
spoke
to
the
they
never
spoke
to
the
accused
person.
So
you
know
that
that's
not
necessarily
going
to
result
in
success
on
these
legal
claims
are
being
brought,
but
it
does.
You
know
it
does
raise
questions
about
the
the
fairness
and
thoroughness
of
the
code
of
conduct
process.
A
There's
still
a
lot.
We
don't
know
about
this
because
there's
very
little
information
in
the
pleadings
that
have
been
filed
so
far
to
date,
and
that
is
that
is
very
much
intentional.
So
some
of
the
lessons
that
we
can
learn
from
this
I'm
actually
going
to
start
with
the
one
at
the
bottom
first.
So
there
is
a
tension
between
wanting
between
presenting
a
very
strong
defense
in
litigation
and
protecting
privacy
of
of
the
victims.
A
Reporters
Etc
right
the
re
part
of
the
reason
why
DCC,
the
Defcon
organizers
they
could
actually
they
could
actually
disclose.
You
know,
even
at
the
pleading
stage,
they
could
disclose
more
facts.
You
know
this
is
the
behavior
he
engaged
in
you
know.
These
are
all
the
witnesses
we
spoke
to.
These
are
the
dates
and
times
that
you
know
he
engaged
in
atrocious,
Behavior
or
so
on
so
forth.
A
They
could
have
included
in
in
some
ways
they
could
have
bolstered
their
defense
early
on
by
including
more
factual
background,
but
they
didn't-
and
although
you
know,
I
I'm
not
involved
in
this
and
I
I,
can't
I
can't
speak
for
the
organizers
or
their
lawyers
I
believe
it's
because
they
are
trying
very
hard
to
protect
privacy
of
the
victims
and
reporters
in
their
anonymity
to
protect,
protect
them
from
both
embarrassment
and
potential
retaliation.
So
I
believe
I
mean
that's.
A
Why
they're
really
focusing
on
defects
in
the
argument
that
Chris
has
raised
rather
than
presenting
facts
in
their
defense
at
this
stage
and
they're,
hoping
that
it's
going
to
be
dismissed?
So
so
we
don't
have
to
proceed
to
Discovery
and
incur
the
stress
and
expense
and
potential
embarrassment
to
those
who
participated
in
the
investigation.
A
So
some
of
the
other
lessons
learned
about
this
any
type
of
public
statement
that
is
potentially
embarrassing
is
often
both
the
motivation
for
and
the
and
the
ground
for
for
filing
a
lawsuit
by
the
accused.
If
you
are
going
to
issue
a
public
statement,
either
stick
to
the
verifiable
facts
or
make
sure
you're
presenting
it,
as
you
know,
as
an
opinion
statement
as
I
I,
do
think
that
the
organizers
of
Defcon
did
do
that
well,
at
least
with
regard
to
positioning
themselves,
well
to
defend
a
defamation
suit.
A
The
false
false
light
claim
is
a
little
bit
a
little
bit
trickier
as
I
as
I
explained
earlier,
and
if
there
are
any
failures
in
due
process,
you
know
it's
not
going
to
look
good
when
that,
when
that's
scrutinized
in
in
a
court
of
law,
so
you
know
I,
know
code
of
conduct
enforcement
is
thank
you.
It's
stressful.
A
It's
time
consuming,
you
know,
but
when
we
do
cut
Corners
it
can
it
can
expose,
expose
you
to
more
risk
and
yeah.
We
we
have
five
minutes
left
so
I'm
going
to
I'm
going
to
really
push
through
these
last
slides,
but
I
am
available
afterwards
and
you're
you're
welcome
to
slack
you
know,
DM
you're
in
slack
or
or
email
me.
If
you,
if
you
have
any
follow-up
questions,
so
litigation
is
very
expensive.
A
That's
one
good
reason
to
avoid
it,
but
it's
also
time
consuming
and
stressful
and
emotionally
taxing
for
everybody
involved.
The
code
of
conduct
enforcers
the
conference,
organizers
or
or
Community
organizers
and
leaders
the
witnesses,
the
the
victims
Etc
and
it's
very
difficult
to
protect
the
Privacy
of
of
the
people
involved.
A
If,
if
your
project
does
have
a
hosting
Foundation
behind
it,
and
it
seems
that
there's
meaningful
legal
risk
or
you,
you
know,
you
need
an
assessment
of
whether
there's
legal
risk.
You
know
I,
encourage
you
to
get
the
lawyers
involved.
At
least
to
evaluate
is
this
you
know.
Is
this
something
that's
going
to
need
legal
support
and
counsel
throughout
the
process
also
having
documentation?
That
shows
that
you're,
that
your
investigation
was
fair
and
thorough
is
also
is
also
very
helpful.
A
A
Note
that
when
there
is
Meaningful
legal
risk,
it
can
be
helpful
to
have
a
lawyer
perform
the
a
lawyer
perform
the
investigation
and
the
reason.
Why
is
because
of
attorney-client
privilege.
So
when
a
lawyer
performs
an
investigation,
there's
something
called
attorney-client
privilege
that
attaches
to
both
their
conversations
with
a
code
of
conduct
committee
and
Foundation
staff,
if
they're,
if
there
is
a
foundation
and
also
the
notes
from
their
investigation,
so
notes
with
interviews
Etc.
A
So
there
is,
and
when
that
privilege
attaches,
that
means
in
litigation
and
Discovery,
that's
the
court
can't
compel
disclosure
of
those
documents.
So
that
is
a
that
is
one
reason
why
you
know
again.
Only
if
the
only
if
there's
meaningful
legal
risk
it
can,
it
can
be
helpful
to
have
a
lawyer.
Do
the
investigation.
A
Note
that
any
messages
you
send
to
anybody,
including
victims,
reporters
the
accused.
If
you
go
to
litigation,
those
will
become
public
or
you
know
they
will
be
public,
they
will
be
scrutinized
or
they'll.
At
least
they
will
be
scrutinized
by
the
court,
so
also
be
thoughtful
about
what
what
you
are
discussing
in
spoken
conversations.
You
know,
for
example,
a
private
code
of
conduct
committee
meeting
versus
in
email
and
writing
because
anything
in
email
and
writing.
A
You
know,
even
if
it's
just
you
know,
you're
joking,
around
you're
being
sarcastic
and
you're.
Like
oh
yeah.
You
know
they
keep
students,
you
know
such
a
such
a
jerk
or
whatever
you
know,
you're
you're,
just
making
it's
you're
thinking
it.
It
may
not
be.
You
may
not
think
it's
it's
serious
conversation,
but
if
that
gets
exposed
to
litigation,
you
know,
whatever
you
said
could
be
used
against
you.
A
A
Also,
if
a
Community
member
is
acting
in
their
individual
capacity
rather
than
under
the
authority
within
their
role
as
a
volunteer,
that's
not
going
to
be
covered
by
insurance
and
insurance
cannot
pay
for
I
mean,
although
it
can
help
with
a
monetary
cost
of
litigation.
It
can't
protect
you
from
all
the
other
costs,
meaning
the
the
time,
the
stress
how
emotionally
draining
it
is,
and
then
it
also
can't
protect
the
the
privacy
of
victims
and
reporters.
So
we
are
out
of
time
I'm.